CVE-2025-52572
PUBLISHEDHikka vulnerable to RCE through dangling web interface
Recommended Action
Track for updates. Assess relevance to your asset inventory and enrichment workflows.
At a Glance
Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenticated session: attacker can use his own Telegram account to gain RCE to the server by authorizing in the dangling web interface. 2. Web interface does have an authenticated session: due to insufficient warning in the authentication message, users were tempted to click "Allow" in the "Allow web application ops" menu. This gave an attacker access not only to remote code execution, but also to Telegram accounts of owners. Scenario number 2 is known to have been exploited in the wild. No known patches are available, but some workarounds are available. Use `--no-web` flag and do not start userbot without it; after authorizing in the web interface, close the port on the server and/or start the userbot with `--no-web` flag; and do not click "Allow" in your helper bot unless it is your explicit action that needs to be allowed.
- CVE Published
- Jun 24, 2025
- —
- —
- CVSS
- 10.0 Critical
- EPSS
- 0.6%
Affected Versions
| Vendor | Product | Version | Status |
|---|---|---|---|
| hikariatama |
Hikka
|
<= 1.7.0-wip |
Affected |
CVE References
- https://github.com/hikariatama/Hikka/security/advisories/GHSA-7x3c-335v-wxjj github.com · CVE Record https://github.com/hikariatama/Hikka/security/advisories/GHSA-7x3c-33...
- https://t.me/bbcode/9 t.me · CVE Record https://t.me/bbcode/9
Recommended Actions
- Track for updates. Assess relevance to your asset inventory and enrichment workflows.
- Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.
No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Virtual Patch
Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.
KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users via the Pro API.
Learn About Virtual PatchesCVSS Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitation Status
No exploitation signals recorded yet.
Weaknesses (CWE)
-
Improper Authentication
Timeline
Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.
-
20:10 UTC about 1 year ago20:10 UTC · about 1 year ago
CVE published
Vulnerability disclosed publicly
-
03:55 UTC about 1 year ago03:55 UTC · about 1 year ago
CVE ID reserved
Identifier reserved by the CNA
Automate This Intelligence with the Pro API
Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
Pro API Example
GET /api/v2/pro/kevs/CVE-2025-52572
{
"cve_id": "CVE-2025-52572",
"title": "Hikka vulnerable to RCE through dangling web interface",
"affected_vendor": "hikariatama",
"affected_product": "Hikka",
"affected_versions": [
{ "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
],
"confidence": null,
"cvss_score": 10.0,
"epss_score": 0.00619,
"exploit_status": {
"exploited_in_the_wild": false,
"active_exploitation_observed": false
},
"sensor_telemetry": { "...": "Pro API fields" },
"proof_of_concepts": [ "..." ],
"scanner_integrations": [ "..." ]
}